漏洞标题
N/A
漏洞描述信息
Linux PV设备前端可能受到后端攻击的影响
本CNA信息记录与多个CVE相关；本文解释了与哪个CVE相关的哪个方面/漏洞。
有几种Linux PV设备前端正在使用授权表接口以绕过后端访问权限，这种方式可能受到竞争条件的影响，导致潜在的数据泄漏，恶意后端对恶意后端的访问以及恶意后端触发的拒绝服务：blkfront、netfront、scsifront和gntalloc驱动正在测试授权引用是否仍在使用。如果这种情况不是，他们假设后续删除授权访问将总是成功，但在后端在这些操作之间映射了授权页面时，这并不总是正确的。因此，后端可以在前端I/O完成之后仍然访问 guest 内存页面，无论页面如何被使用。xenbus驱动也有类似的问题，因为它没有检查共享环流缓冲区删除授权访问的成功。
blkfront:CVE-2022-23036 netfront:CVE-2022-23037 scsifront:CVE-2022-23038 gntalloc:CVE-2022-23039 xenbus:CVE-2022-23040
blkfront、netfront、scsifront、usbfront、dmabuf、xenbus、9p、kbdfront和pvcalls正在使用一种功能，在不再使用授权引用时延迟释放授权引用，但相关数据页面的释放与删除授权访问同步不成立。因此，后端可以在释放后重新使用内存页面，即使该页面已释放并用于其他目的。
CVE-2022-23041 netfront如果rx路径上无法撤销访问，将失败一个BUG_ON()断言。这将导致后端可以触发 guest 的拒绝服务(DoS)情况。
CVE-2022-23042
CVSS信息
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV device frontends are using the grant table interfaces for removing access rights of the backends in ways being subject to race conditions, resulting in potential data leaks, data corruption by malicious backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they assume that a following removal of the granted access will always succeed, which is not true in case the backend has mapped the granted page between those two operations. As a result the backend can keep access to the memory page of the guest no matter how the page will be used after the frontend I/O has finished. The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038 gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus, 9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no longer in use, but the freeing of the related data page is not synchronized with dropping the granted access. As a result the backend can keep access to the memory page even after it has been freed and then re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which can be triggered by the backend. CVE-2022-23042
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Linux 竞争条件问题漏洞
漏洞描述信息
Linux是美国Linux基金会的开源操作系统。 Linux PV 设备存在安全漏洞，该漏洞源于竞争条件和 Linux 中缺少返回码测试，PV 设备前端驱动程序恶意后端可以访问（读取并写入）到它不应该有的内存页面，或者它可以直接在来宾中触发拒绝服务 (DoS)。
CVSS信息
N/A
漏洞类别
竞争条件问题